From 7831c8ae20af439ad516968674bd458ba77bf316 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 8 Jun 2023 12:12:11 -0700 Subject: [PATCH 1/2] Revert to previous version in develop. This ammends an unintentional commit directly to develop. --- ...response_splitting_via_rest_spl_command.yml | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml b/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml index f991b76a5f..4eb4f13788 100644 --- a/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml +++ b/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml @@ -7,10 +7,17 @@ status: production type: Hunting data_source: - audittrail -description: A low-privileged user, using a specially crafted search command, can trigger an HTTP response splitting vulnerability with the rest SPL command that lets them potentially access other REST endpoints in the system arbitrarily, including accessing restricted content such as password files. This is because the user is able to inject the rest SPL command into the q parameter of an HTTP GET web request. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will. -search: '`audit_searches` AND search IN ("*|*rest*POST*","*|*rest*PUT*","*|*rest*PATCH*","*|*rest*DELETE*") AND NOT search="*audit_searches*" | table user info has_error_msg search _time | `splunk_http_response_splitting_via_rest_spl_command_filter`' -how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search may assist in detecting possible http response splitting exploitation attemptss. -known_false_positives: This search may have produce false positives as malformed or erroneous requests made to this endpoint may be executed willingly or erroneously by operators. +description: A low-privileged user, using a specially crafted search command, can trigger an HTTP response splitting vulnerability with the rest +SPL command that lets them potentially access other REST endpoints in the system arbitrarily, including accessing restricted content such as +password files. This is because the user is able to inject the rest SPL command into the q parameter of an HTTP GET web request. The +vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot +exploit the vulnerability at will. +search: '`audit_searches` AND search IN ("*|*rest*POST*","*|*rest*PUT*","*|*rest*PATCH*","*|*rest*DELETE*") AND NOT search="index=_audit" | table +user info has_error_msg search _time | `splunk_http_response_splitting_via_rest_spl_command_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. +This search may assist in detecting possible http response splitting exploitation attemptss. +known_false_positives: This search may have produce false positives as malformed or erroneous requests made to this endpoint may be executed +willingly or erroneously by operators. references: - https://advisory.splunk.com/ tags: @@ -40,7 +47,8 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.006/splunk/splunk_http_response_splitting_via_rest_spl_command.log + - data: +https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.006/splunk/splunk_http_response_splitting_via_rest_spl_command.log source: audittrail sourcetype: audittrail custom_index: _audit From 84af2e0f6b9fd012a17b540299f12e48dec69036 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 8 Jun 2023 12:19:11 -0700 Subject: [PATCH 2/2] Update splunk_http_response_splitting_via_rest_spl_command.yml --- ...response_splitting_via_rest_spl_command.yml | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml b/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml index 4eb4f13788..175cd974a4 100644 --- a/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml +++ b/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml @@ -7,17 +7,10 @@ status: production type: Hunting data_source: - audittrail -description: A low-privileged user, using a specially crafted search command, can trigger an HTTP response splitting vulnerability with the rest -SPL command that lets them potentially access other REST endpoints in the system arbitrarily, including accessing restricted content such as -password files. This is because the user is able to inject the rest SPL command into the q parameter of an HTTP GET web request. The -vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot -exploit the vulnerability at will. -search: '`audit_searches` AND search IN ("*|*rest*POST*","*|*rest*PUT*","*|*rest*PATCH*","*|*rest*DELETE*") AND NOT search="index=_audit" | table -user info has_error_msg search _time | `splunk_http_response_splitting_via_rest_spl_command_filter`' -how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. -This search may assist in detecting possible http response splitting exploitation attemptss. -known_false_positives: This search may have produce false positives as malformed or erroneous requests made to this endpoint may be executed -willingly or erroneously by operators. +description: A low-privileged user, using a specially crafted search command, can trigger an HTTP response splitting vulnerability with the rest SPL command that lets them potentially access other REST endpoints in the system arbitrarily, including accessing restricted content such as password files. This is because the user is able to inject the rest SPL command into the q parameter of an HTTP GET web request. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will. +search: '`audit_searches` AND search IN ("*|*rest*POST*","*|*rest*PUT*","*|*rest*PATCH*","*|*rest*DELETE*") AND NOT search="index=_audit" | table user info has_error_msg search _time | `splunk_http_response_splitting_via_rest_spl_command_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search may assist in detecting possible http response splitting exploitation attemptss. +known_false_positives: This search may have produce false positives as malformed or erroneous requests made to this endpoint may be executed willingly or erroneously by operators. references: - https://advisory.splunk.com/ tags: @@ -47,8 +40,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: -https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.006/splunk/splunk_http_response_splitting_via_rest_spl_command.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.006/splunk/splunk_http_response_splitting_via_rest_spl_command.log source: audittrail sourcetype: audittrail custom_index: _audit